Rules and ethics
Part of Before you launch, review the programmatic advertising rules and ethics
Programmatic advertising UK regulations: PECR consent, UK GDPR lawful basis and the ICO children's code
Programmatic advertising rules in England: PECR regulation 6, UK GDPR Article 6 lawful bases, Article 9 special category data and the ICO children's code.
Programmatic advertising UK regulations are the statute and regulator guidance that apply when you buy or sell ad space through automated systems. For an English agency, four sources do most of the work: PECR on cookies and identifiers, UK GDPR on personal data, ICO guidance on inferred data and the ICO children's code.
What to take away
- Storing or accessing information on a user's device is barred unless the conditions are met.
- Online advertising uses of storage and access technologies require consent.
- A lawful basis must be set and documented before you start using personal information.
- Inferred sensitive interests can count as special category data.
- The best interests of the child come first for services likely to be accessed by children.
Cookies and identifiers: PECR regulation 6
Under PECR regulation 6, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user, subject to Schedule A1. That covers cookies, device identifiers and similar tags used for targeting.
Using storage and access technologies for online advertising requires consent, as the ICO states in its online advertising guidance. That covers ad selection and delivery as well as tracking and profiling. Advertising measurement needs no separate consent.
Consent across the bidstream
Where you pass consent-based data to third parties, the consent must apply across the chain. If you collected it, you are responsible for telling those third parties when it is no longer valid. Ask each vendor how it passes on consent signals.
Keep evidence of how consent was captured, when, and what the user was told. Store the consent record next to the campaign identifier so the link can be traced. The GDPR consent article shows how the signal travels.
Personal data: UK GDPR Article 6 lawful bases
Choose a lawful basis for each audience segment before the first bid, not once per account. Record the basis, the person who chose it and the review date. A segment with no recorded basis stays out of the campaign until someone signs it off.
UK GDPR Article 6(1) / Lawful basis
- Point (a)
- Consent
- Point (b)
- Performance of a contract
- Point (c)
- Legal obligation
- Point (d)
- Vital interests
- Point (e)
- Public interest or official authority
- Point (f)
- Legitimate interests
Weigh point (f) against the interests of the person profiled, in particular where that person is a child. Record the balance in the same file as the basis.
Special category data: Article 9(1)
Inference needs care. Segments built on guessed political interests need a stricter check than ordinary interest segments. Exclude them by default and let a named person approve any exception.
UK GDPR Article 9(1) special category / Segment rule
- Racial or ethnic origin; political opinions
- Exclude inferred segments by default
- Religious or philosophical beliefs; trade union membership
- Exclude inferred segments by default
- Genetic data; biometric data used to identify a person
- Exclude inferred segments by default
- Health; sex life or sexual orientation
- Exclude inferred segments by default
The data protection review sets out the wider process for special category data and for children's data, so log each decision there.
Children's data: ICO children's code
Check before launch whether children could reach the inventory you buy. Ask each publisher how it handles age, and write the answer into the campaign file.
Treat this as a design constraint when your inventory could reach young users. Build for it at setup, not after a complaint.
| Children's code topic | Programmatic check |
|---|---|
| Best interests of the child | Weigh them at campaign setup |
| Age appropriate application | Ask each publisher how it knows user ages |
| Detrimental use of data | Review how an audience is built before it is bought |
| High-privacy default settings | Prefer inventory whose defaults protect privacy |
| Data minimisation and data sharing | Pass the least data to the fewest vendors |
| Geolocation | Switch location targeting off for audiences that may include children |
| Profiling and nudge techniques | Exclude profiling and nudges that push children to give more data |
The main obligations in one table
| Area | Authority / rule | Action for a campaign |
|---|---|---|
| Cookies and identifiers | PECR regulation 6 | Store or read device information only where its conditions are met |
| Online advertising | ICO guidance on storage and access technologies | Obtain consent for ad selection, delivery, tracking and profiling |
| Personal data | UK GDPR, ICO guide to lawful basis | Determine and document the basis before use |
| Inferred data | ICO guidance on special category data | Check segments built on inferred political interests |
| Children | ICO age appropriate design code (15 standards), standard 1 | Weigh the child's best interests at campaign setup |
Check the current text of each source before launch, because guidance changes. The UK rules and compliance guide maps these duties to practical controls, and the quality checklist is where to log each result.
Working with vendors and platforms
Your platform contracts should state who is controller and who is processor for each data flow. Put the answer in the commercial contracts and ask for it during vendor due diligence. A written record helps new team members understand the chain.
Review your position each quarter. Guidance changes and publishers adjust their consent tools. A short checklist run against live campaigns catches drift before it becomes a complaint.
Before you act
- Confirm consent is in place before any identifier is stored or read.
- Ask every vendor how it passes consent signals downstream.
- Document an Article 6 lawful basis for each audience segment.
- Exclude segments built on inferred Article 9 special category interests.
- Review children's data risk at campaign setup.
Common questions
Do PECR rules apply to programmatic advertising in England?
Yes. Obtain consent before identifiers are stored or read for advertising, subject to the exceptions in Schedule A1. The rule on cookies and identifiers covers the whole UK, so England is not treated separately.
What extra duties apply to children's data?
Check the children row in the table above and apply it at campaign setup, before any inventory is bought.
Is this legal advice?
No. It is general guidance on the regulatory picture in England. Individual cases, especially consent disputes or children's data, need a qualified adviser.
